October CMS CVE-2024-4900: PHP Object Injection in Widget Session

Vulnerability Summary: PHP Object Injection (via Backend Widget Session Storage) Vulnerability Overview Vulnerability Name: PHP Object Injection via Backend Widget Session Storage CVE ID: CVE-2024-4900 CVSS 3.1 Score: 9.8 (Critical) Affected Package: Affected Versions: <4.3.17, <4.2.20 Fixed Versions: 3.7.17, 4.2.21 Vulnerability Type: Object Injection CWE: CWE-502 (Deserialization of Untrusted Data) Reporter: Endsightmare Scope of Impact Affects all instances where is enabled, as well as multi-tenant/shared server scenarios. Attack Path: The attacker controls the bytes written to the session key → PHP object injection is triggered when the session is read next time. Exploitation Conditions: - Requires to be enabled, and the backend user to possess CMS-tagged editing permissions (not full administrator). - Requires the presence of an instantiable PHP gadget from the dependency set. - Not exploitable when Safe Mode is disabled. Fix Details Fixed in v3.7.17 and v4.2.21, which applied two changes: 1. : The new version stores widget session state as pure JSON instead of , eliminating the object injection risk for new session writes; on read, it transparently falls back to the old format for compatibility with legacy sessions during the upgrade cycle. 2. The fallback path now sets , ensuring that legacy values written before the upgrade cannot instantiate objects. Temporary Workarounds If an immediate upgrade is not possible: Restrict CMS-tagged editing permissions to fully trusted administrators only (a standard October CMS best practice). POC / Exploit Code The page does not contain a specific POC or exploit code block.

Goal Reached Thanks to every supporter — we hit 100%!

October CMS CVE-2024-4900: PHP Object Injection in Widget Session

More from this source